CVE-2009-1959: irssi Numeric Errors

CVSS: 5.0v2.0MediumModified

AliasesDEBIAN-CVE-2009-1959

Published 06-06-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-1959 is a medium (CVSS 5.0) Numeric Errors vulnerability in irssi. EPSS estimates a 8.38% chance of exploitation in the next 30 days, higher than 94.9% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk

32/100

0100

Medium · default modelHow is this calculated?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

8.38%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits4reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2024:10455-1

Timeline

06-06-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Off-by-one error in the event_wallops function in fe-common/irc/fe-events.c in irssi 0.8.13 allows remote IRC servers to cause a denial of service (crash) via an empty command, which triggers a one-byte buffer under-read and a one-byte buffer underflow.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

8.38%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 8.38% on 21-09-2026

21-09-202621-10-2026

EPSS score

8.38%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found

referenceUnverified
Exploit Reference (xorl.wordpress.com)
Maturity: unknown
referenceUnverified
Exploit Reference (irssi.org)
Maturity: unknown
referenceUnverified
Exploit Reference (bugs.irssi.org)
Maturity: unknown

Show all 4 exploits

exploit-databasedoslinuxVerified
Irssi 0.8.13 - 'WALLOPS' Message Off-by-One Heap Memory Corruption
Maturity: poc

Weaknesses

CWE · root cause

CWE-189Numeric ErrorsWeaknesses in this category are related to improper calculation or conversion of numbers.

Affected systems

Debian1 product

irssi< 0.8.13-2

Irssi1 product

irssi0.8.13

2 vendors · 2 products

References

16 links

xorl.wordpress.com/2009/05/28/irssi-event_wallops-off-by-one-readwrite/X Refsource MISCExploit
www.securitytracker.com/id?1022410VDB EntryX Refsource SECTRACK
www.openwall.com/lists/oss-security/2009/05/29/3Mailing ListX Refsource MLIST
www.securityfocus.com/bid/35399VDB EntryX Refsource BID
www.irssi.org/ChangeLogX Refsource CONFIRMExploitVendor Advisory
www.redhat.com/archives/fedora-package-announce/2009-August/msg00146.htmlVendor AdvisoryX Refsource FEDORA
bugs.irssi.org/index.php?do=details&task_id=662X Refsource CONFIRMExploitVendor Advisory
secunia.com/advisories/35685Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2009/1596VDB EntryX Refsource VUPEN
lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.htmlVendor AdvisoryX Refsource SUSE

Show all 16 references

www.ubuntu.com/usn/usn-800-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/35812Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2009:133Vendor AdvisoryX Refsource MANDRIVA
exchange.xforce.ibmcloud.com/vulnerabilities/51184VDB EntryX Refsource XF
secunia.com/advisories/36152Third Party AdvisoryX Refsource SECUNIA
security-tracker.debian.org/tracker/CVE-2009-1959Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities